Currently, much of the utility of computer systems lies in their ability to communicate and share information with other computer systems. Information is typically passed between computer systems via computer networks. Computer networks are groups of computers interconnected by wires or wireless mechanisms such as infrared, radio, and other technologies. The Internet is a global network of many smaller computer networks connected to one another. There is no controlling central network, but rather several high level networks that are connected through network access points. A network access point is a computer hardware or software device (commonly a network router) that serves as a kind of translator between two different networks.
Web services, generally, refers to application-to-application communication over the Internet via programmatic interfaces. For example, a local application (e.g., Microsoft® Money) on a client computer may communicate with a server application on a remote computer to obtain stock ticker information. The two applications may communicate the requested ticker symbol and the corresponding results via one or more messages transmitted over the Internet, without opening or using a traditional Internet browser such as Internet Explorer®.
An access control list (ACL), generally, is a data structure that defines who has access to a single specified object stored on a computer or network. More specifically, an ACL typically indicates the access rights each user or group has. Access rights for file objects typically include the right to read a file, write the file, delete the file, and execute the file. Examples of objects to which ACLs may refer include files, directories, subdirectories, web services, computer resources, and the like. In known ACL-based systems, each object includes a security attribute that identifies its corresponding ACL. Typically the metadata for each object points to its corresponding ACL. FIG. 1 illustrates a logical relationship between objects (files) stored on a computer and corresponding ACLs according to known ACL solutions, where each file points to a corresponding ACL defining its access rights. In other known systems (not shown), two or more objects may point to the same ACL, however, the ACL cannot indicate the objects to which it corresponds. That is, one cannot learn for which objects an ACL defines access rights by querying the ACL; instead, one must query the object to determine the corresponding ACL.
Known ACLs provide limited group and role-based access rights. Group access rights refer to granting access rights to each user who is a member of a specified group, e.g., a department within a company. Role-based access rights refer to granting access rights to each user identified as having a specified role, e.g., “tester” or “programmer”. However, known ACL solutions do not allow dynamic access rights based on other attributes, nor do known ACL solutions allow an ACL or other access control element to determine the objects for which it defines access rights.
Thus, it would be an advancement in the art to be able to have an access control element that indicates the objects for which it defines access rights. It would be a further advancement if the access control element allowed access rights to be based on constraints other than a user's identity, group, or role.